Messages in this thread Patch in this message | | | From | Sungbae Yoo <> | Subject | [PATCH] Smack: replace capable() with ns_capable() | Date | Fri, 24 Jul 2015 20:26:14 +0900 |
| |
If current task has capabilities, Smack operations (eg. Changing own smack label) should be available even inside of namespace.
Signed-off-by: Sungbae Yoo <sungbae.yoo@samsung.com>
diff --git a/security/smack/smack_access.c b/security/smack/smack_access.c index 00f6b38..f6b2c35 100644 --- a/security/smack/smack_access.c +++ b/security/smack/smack_access.c @@ -639,7 +639,7 @@ int smack_privileged(int cap) struct smack_known *skp = smk_of_current(); struct smack_onlycap *sop; - if (!capable(cap)) + if (!ns_capable(current_user_ns(), cap)) return 0; rcu_read_lock(); diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c index a143328..7fdc3dd 100644 --- a/security/smack/smack_lsm.c +++ b/security/smack/smack_lsm.c @@ -403,7 +403,8 @@ static int smk_ptrace_rule_check(struct task_struct *tracer, rc = 0; else if (smack_ptrace_rule == SMACK_PTRACE_DRACONIAN) rc = -EACCES; - else if (capable(CAP_SYS_PTRACE)) + else if (ns_capable(__task_cred(tracer)->user_ns, + CAP_SYS_PTRACE)) rc = 0; else rc = -EACCES; -- 1.9.1
| |